Description of the patch:
This update for ImageMagick fixes the following issues:
- CVE-2026-53466: integer overflow in the XCF decoder can result in an out-of-bounds read when a crafted image is read
(bsc#1270073).
- CVE-2026-53467: allocated memory left unchanged in the MNG decoder can lead to a heap information disclosure
(bsc#1270074).
- CVE-2026-55594: missing depth check in the MVG decoder will result in a stack overflow when a crafted image is
provided (bsc#1270077).
- CVE-2026-55595: providing invalid arguments to the
connected-components option can lead to an infinite loop
(bsc#1270079).
- CVE-2026-55597: incorrect handling of arguments can cause a heap buffer over-write in the JP2 encoder (bsc#1270080).
- CVE-2026-56361: off-by-one error in morphology validation can lead to an out-of-bounds read (bsc#1270001).
- CVE-2026-56363: integer overflow leading to a division by zero in binomial kernel processing can cause an application
crash (bsc#1270002).
- CVE-2026-56364: memory leak in
LoadOpenCLDeviceBenchmark function when parsing malformed OpenCL device profile XML
files with unclosed device elements (bsc#1270003).
- CVE-2026-56374: missing boundary checks can lead to a heap buffer overflow in the FTXT encoder when parsing
ftxt:format (bsc#1271099).
- CVE-2026-56379: arbitrary MVG drawing command injection via the SVG decoder when processing specially crafted SVG
files (bsc#1268878).
- CVE-2026-42050: stack buffer overflow via a malicious MIFF file (bsc#1265048).
- CVE-2026-42326: out-of-bounds read of single byte via malicious IPTC file (bsc#1268092).
- CVE-2026-45031: missing check in the PSD decoder allows bypass of the list-length resource policy when decoding a PSD
image (bsc#1268094).
- CVE-2026-45358: off-by-one error in the meta encoder can lead to an out-of-bounds read of a single byte
(bsc#1268102).
- CVE-2026-45359: heap buffer overread via invalid
connected-components value (bsc#1268095).
- CVE-2026-45624:...